Dateline: September 1, 2026
The Patch Shipped in August. 22,000 Exchange Servers Never Got It.
Three weeks after the patch shipped, nearly 22,000 Microsoft Exchange servers are still wide open. One flaw. Every mailbox on the box up for grabs.
That is the picture from fresh internet scans. A high severity bug in Exchange lets an attacker take over the mailboxes of every user on a vulnerable server. Read email. Send email as anyone. Pull down attachments. And the patch has been available since August.
What Happened
The flaw is tracked as CVE-2026-62911. Microsoft patched it during the August 2026 Patch Tuesday and rated it 8.0 on the severity scale. It is an authentication bypass by capture and replay, which means an attacker who can grab and resend valid authentication traffic can impersonate real users and climb to higher privileges across the server.
It affects Exchange Server 2016, Exchange Server 2019, and the newer Subscription Edition. An attacker needs only basic privileges on the target and some user interaction to pull it off. In Microsoft’s own words, they could take over the mailboxes of all Exchange users.
Here is the part that should worry defenders. A threat watchdog group counted 21,899 exposed servers still unpatched as of August 31. Most sit in the United States, around 6,200, and Germany, around 5,100. A national cyber agency in the Netherlands also reported that exploit code for the bug is already circulating online, though Microsoft has not confirmed active attacks yet.
What’s the Impact
Exchange is not just another server. It is the front door to a company’s email, and email is where password resets, contracts, invoices, and executive conversations all live.
A mailbox takeover at this level is a launchpad. An attacker reading the CEO’s inbox can time a wire fraud request perfectly. One sitting in the finance team’s mail can redirect an invoice. Access like this also feeds business email compromise, where a hijacked account sends a believable message to a partner or customer, and the money goes to the wrong account.
There is history here too. Since late 2021, a large batch of Exchange flaws have landed on the government’s list of actively exploited bugs, and many of those were also used in ransomware attacks. Exchange has a track record of going from “patch available” to “patch or get breached” fast. The 8.0 rating and public exploit code point the same direction.
The servers most at risk are the internet facing ones. Exchange 2016 and 2019 have also reached end of support, so many of these boxes only get fixes through a paid extended update program that itself winds down in October.
How to Avoid This
The fix exists. The problem is getting it applied before someone writes a reliable exploit.
- Patch CVE-2026-62911 now on every Exchange 2016, 2019, and Subscription Edition server, starting with anything reachable from the internet.
- If you cannot patch today, pull the server off the public internet and make it reachable internally only.
- Hunt for signs of replayed authentication and mailbox access from odd locations or at odd hours. Behavior is the tell, since there is no single file to scan for.
- Inventory every Exchange box you run, including the forgotten one in a branch office. You cannot patch what you do not know is there. This is the same gap we covered in risk based vulnerability management and the fix first list.
- Plan the retirement of end of support Exchange versions before the extended update program ends.
Most breaches do not start with a clever zero day. They start with a known bug and a patch that sat in a queue too long, which is exactly the remediation SLA problem security teams keep losing to.
